Effective Date: 11/03/2025
Notice at Collection and Privacy Policy for California Residents
This California Notice at Collection and Privacy Policy for Applicants and Employees (“CCPA Workforce Disclosure”) explains how CITITRENDS, Inc. and its subsidiaries and affiliates (“we” “us”, “our”, or “Company”), collects, uses, discloses, sells, shares, and retains personal information (“Information Practices”) subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”). This CCPA Workforce Disclosure applies solely to California residents who interact with us as a job applicant (“Applicants”), and employees, independent contractor, or in an employment related context (collectively, “Employees”). For ease of reading, “you” refers to both Applicants and Employees.
Notice at Collection
The following notice identifies the categories of personal information to be collected from you and the purposes for which the personal information will be used, including whether that information is sold or shared.
General Personal Information
Categories of Personal Information | Purposes for Collection and Use |
| Identifiers: For example, a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers. |
|
| Personal Information Categories from Cal. Civ. Code § 1798.80(e): For example, name, Social Security number, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, medical information, or health insurance information. | |
| Characteristics of CA or Federal Protected Classifications: For example, race, religion, national origin), age (40 and over), gender, medical condition, familial status, disability, or veteran status. | |
| Commercial Information: For example, records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. | |
| Biometric Information: Biometric information includes, but is not limited to, imagery of the face, from which an identifier template, such as a faceprint, can be extracted, and health or exercise data that contain identifying information. | |
| Internet or Other Similar Network Activity: For example, browsing history, search history, and information regarding your interaction with an Internet Web site or application. | |
| Geolocation Data: For example, a device’s physical location. | |
| Sensory or Surveillance Data: For example, video, electronic, or audio surveillance and monitoring for security purposes. This would include call recordings and monitoring security badge use or IT login access. | |
| Professional or Employment-Related Information: For example, compensation, evaluations, performance reviews, personnel files, and current and past job history. | |
| Education Information: For example, student records or directory information (as defined in the Family Education Rights and Privacy Act). | |
| Profile Data: For example, information about your behavior and aptitudes for hiring, retention, and promotion purposes. |
Sensitive Personal Information
We do not use or disclose the below sensitive personal information of employees or applicants for purposes other than those business purposes specifically enumerated under CCPA. As a result, we do not offer a right to limit our use or disclosure of these categories of sensitive personal information.
Categories of Sensitive Personal Information | Purposes for Collection and Use |
| Social Security Number, Driver’s License, State Identification Card, or Passport Number |
|
| Account log-in, financial account, debit card, or credit card number when provided with any required security or access code, password, or credentials allowing access to an account | |
| Precise geolocation | |
| Racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership | |
| Contents of a consumer’s mail, email, and text messages (unless we are the intended recipient of the communication) | |
| Genetic data, neural data | |
| Biometric information for the purpose of unique identification | |
| Health information | |
| Information concerning sex life or sexual orientation |
In addition to the purposes identified above, we may collect and use personal information as necessary or appropriate to:
- Comply with laws and regulations, including, without limitation, applicable tax, health and safety, antidiscrimination, immigration, labor and employment, and social welfare laws;
- Monitor, investigate, and enforce compliance with and potential breaches of Company policies and procedures and legal and regulatory requirements;
- Comply with civil, criminal, judicial, or regulatory inquiries, investigations, subpoenas, or summons; and
- Exercise or defend the legal rights of Company and its employees, affiliates, customers, contractors, and agents.
Retention Periods
Records containing personal information shall be retained if a valid business reason exists or as required by applicable law. Personal information will only be retained as long as it is reasonably necessary and proportionate for the purposes for which personal information is processed. Valid business reasons include the effective operation of our business, to manage your employment with us, to administer payroll and benefits, to comply with legal and regulatory obligations, and legal retention requirements, which may be pertinent to ongoing or reasonably foreseeable litigation, legal hold, or government investigation.
Selling/Sharing: We have not and do not sell any of your personal information or share with third parties for cross-context behavioral advertising (including any sensitive personal information).
Privacy Policy
The purpose of this privacy policy is to provide you with a comprehensive description of our online and offline practices regarding our collection, use, disclosure, [selling, sharing,] and/or retention of your personal information (“Information Practices”). This privacy policy describes your rights as it relates to our Information Practices and how you can exercise those rights.
The following table includes disclosures for the preceding 12 months of: categories of personal information we have collected about you, the categories we have disclosed for a business purpose, and categories of third parties with whom we shared the personal information during that period.
General Personal Information
Category | In the preceding 12 months this category was: | Business or Commercial Purpose for Collection & Disclosure | Categories of third parties to whom the information was disclosed | |
Collected | Disclosed | |||
| Identifiers | ☒ | ☒ |
| Service Providers that assist with:
Others
Government entities |
| Personal Information Categories from Cal. Civ. Code § 1798.80(e) | ☒ | ☒ | ||
| Characteristics of CA or Federal Protected Classifications | ☒ | ☒ | ||
| Commercial Information | ☒ | ☒ | ||
| Biometric Information | ☒ | ☒ | ||
Internet or Other Similar Network Activity
| ☒ | ☒ | ||
| Geolocation Data | ☒ | ☒ | ||
Sensory or Surveillance Data
| ☐ | ☐ | ||
| Professional or Employment-Related Information | ☒ | ☒ | ||
| Education Information | ☒ | ☒ | ||
| Profile Data | ☒ | ☒ | ||
Sensitive Personal Information
We do not use or disclose the below sensitive personal information of employees or applicants for purposes other than those business purposes specifically enumerated under CCPA. As a result, we do not offer a right to limit our use or disclosure of these categories of sensitive personal information.
Category | In the preceding 12 months this category was: | Business or Commercial Purpose for Collection & Disclosure | Categories of third parties to whom the information was disclosed | |
Collected | Disclosed | |||
| Social Security Number, Driver’s License, State Identification Card, or Passport Number | ☐ | ☐ |
| Service Providers that assist with:
Others
Government entities |
Account log-in, financial account, debit card, or credit card number when provided with any required security or access code, password, or credentials allowing access to an account
| ☐ | ☐ | ||
Precise geolocation
| ☐ | ☐ | ||
Racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership
| ☐ | ☐ | ||
| Contents of a consumer’s mail, email, and text messages (unless we are the intended recipient of the communication) | ☐ | ☐ | ||
| Genetic Data, Neural Data | ☐ | ☐ | ||
Biometric information for the purpose of unique identification
| ☐ | ☐ | ||
| Health Information | ☐ | ☐ | ||
| Information concerning sex life or sexual orientation | ☐ | ☐ | ||
We may also disclose your personal information to the following categories of third parties:
- At Your Direction. We may disclose your personal information to any third party with your consent or at your direction.
- Business Transfers or Assignments. We may disclose your personal information to other entities as reasonably necessary to facilitate a merger, sale, joint venture or collaboration, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).
- Legal and Regulatory. We may disclose your personal information to government authorities, including regulatory agencies and courts, as reasonably necessary for our business operational purposes, to assert and defend legal claims, and otherwise as permitted or required by law.
The categories identified as collected in the tables above were collected from the following categories of sources:
- Information from you that you directly provide to us.
- Information from you that you provide passively from your use of employer owned devices or on personal devices in the course and scope of your employment with us.
- Information about you from third party sources:
- Internet service providers
- Data analytics providers
- Public record sources
- Government entities
- Operating systems and platforms
- Social media networks and platforms
- Professional Organizations
- Recruitment Organizations or Firms
- Data Brokers
- Credit Reporting Agencies or Resellers
Selling to Third Parties or Sharing with Third Parties for Cross-Context Behavioral Advertising
[We have not and do not sell any of your personal information or share with third parties for cross-context behavioral advertising (including any sensitive personal information).] We do not have actual knowledge that we sell or share the personal information of minors under 16 years of age.
Your Right to Know
You have the right to request any of the following:
- the categories of personal information we have collected about you
- the categories of sources from which the personal information is collected
- the business or commercial purpose for collecting, selling, or sharing with third parties for cross context behavioral advertising (e.g. targeted advertising)
- the categories of third parties to whom we disclose personal information
- the specific pieces of personal information we have collected about you
You can do this through a verified consumer request. That process is described below in the section, “Submitting a Verified Consumer Request.”
Your Right to Request Correction of Inaccurate Personal Information
You have the right to request correction of inaccurate personal information maintained by us. We may request documentation from you to determine the accuracy of the information. If you provide us documentation either upon our request or through your own initiative, that documentation will only be used for the purpose of correcting your personal information and complying with our recordkeeping requirements. We may deny your request if we have previously denied your same request to correct an alleged inaccuracy in the past six (6) months unless you provide new or additional documentation that the information at issue is inaccurate.
As an alternative to correction, we may delete the inaccurate information if it does not negatively impact you or if you consent to this deletion. We reserve the right to deny this request if allowed under law, or if we determine that the contested information is more likely than not accurate, based on the totality of circumstances. You can submit a correction request through a verified consumer request. That process is described below in the section, “Submitting a Verified Consumer Request.”
Your Right to Request Deletion of Your Personal Information
You have the right to request that we delete any of your personal information collected by us, subject to certain exceptions. You can do this through a verified consumer request. That process is described below in the section, “Submitting a Verified Consumer Request.”
There may be scenarios where we deny your deletion request. If that occurs, we will provide you with an explanation as to why we could not delete all or some of your personal information.
How to Exercise Your Rights
Submitting a Verified Consumer Request
You have the right to submit verified consumer requests to know information, to correct information, or for deletion.
You can submit requests to request access to, correction of, deletion of or limitation on the use of your personal information. To submit a request, please contact us by email at privacy@cititrends.com or by mailing us at: CitiTrends Inc. 17 Park of Commerce Boulevard, Suite 200, Savannah, Georgia 31405.
When submitting your request, please include the following information to help us locate your records and verify your identity: your full legal name, employee or contractor ID (if applicable), email address on file, state of residence, and the request type (for example, “access”, “delete” or “correct”). Your request will be verified by matching the information you provide to information that we have collected.
If you submit a request that is not through one of these designated methods or is deficient in some manner unrelated to verification, we will provide you with information on how to submit the request or remedy any deficiencies.
Once we receive your verifiable consumer request, we will confirm receipt of the request within 10 business days describing our verification process. We will respond to your request within 45 calendar days, if we are able to verify your identity.
The response to a request to know will provide all personal information collected and maintained about you since January 1, 2022, unless doing so proves impossible or would involve disproportionate effort. Please note that we are not required to provide personal information to you more than twice in a 12-month period. We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.
Requests to Know or Delete Information About a Child Under the Age of 13: We accept requests for information regarding minors under the age of 13 if we can determine that such requests were submitted by a parent or guardian.
Using an Authorized Agent to Submit a Request
Only you, a person registered with the California Secretary of State, or a person you authorize to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child. If you use an authorized agent, you may provide a power of attorney executed pursuant to California Probate Code sections 4000 to 4465. If a power of attorney that meets those provisions is not submitted, you will be required to verify your identity directly with us, and directly confirm with us that you provided the authorized agent permission to submit the request.
If you’re an authorized agent making a request to the Human Resources department, you must email us at Privacy@cititrends.com and:
- Provide the power of attorney provided to you by the consumer pursuant to Probate Code sections 4000 to 4465; or
- Provide proof of signed permission along with a copy of your ID and have the consumer e-mail us at this same address to directly confirm with us that they provided you permission to submit the request.
Your Right to Non-Discrimination for the Exercise of a Privacy Right
We will not discriminate or retaliate against you for exercising any of your CCPA rights.
Changes to Our Privacy Notice
We reserve the right to amend this privacy notice at our discretion and at any time. When we make changes to this privacy notice, we will post the updated notice on this page and update the notice’s effective date.
Contact for More Information
If you have any questions or comments about this notice, the ways in which we collect and use your information, your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us at:
Email: Privacy@cititrends.com
Mailing Address: CitiTrends, Inc. 17 Park of Commerce Boulevard, Suite 200, Savannah, Georgia 31405.
